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Abstract 

Use of unmanned aircraft systems (UASs) has 
been characterized as the next great step forward in 
the evolution of civil aviation. Indeed, UASs are in 
limited civil use in the United States today, and 
many believe that the time is rapidly approaching 
when they will move into the commercial 
marketplace, too. To make this a reality, a number 
of challenges must be overcome to develop the 
necessary regulatory framework for assuring safe 
operation of this special class of aircraft. 

This paper discusses some of what must be 
done to establish that framework. In particular, we 
examine hazards specific to the design, operation, 
and flight crew of UASs, and discuss implications 
of these hazards for existing policy and guidance. 
Understanding unique characteristics of UASs that 
pose new hazards is essential to developing a 
cogent argument, and the corresponding regulatory 
framework, for safely integrating these aircraft into 
civil airspace. 

Introduction 

An unmanned aircraft system comprises an 
aircraft 1 flown by a pilot via a ground control 
station or autonomously through on-board 
automation, communication links, and any other 
equipment, including launch and recovery systems, 
necessary to operate the aircraft safely. In 
testimony before Congress on July 13, 2006, 
Nicholas Sabatini, Associate Administrator for 
Aviation Safety for the Federal Aviation 
Administration (FAA), stated that “the development 
and use of unmanned aircraft systems is the next 
great step forward in the evolution of aviation” [1]. 
During his testimony, Mr. Sabatini also noted that 


1 Unmanned aircraft refers specifically to an air vehicle that 
does not have an on-board crew. For this paper, we are not 
considering such aircraft with passengers on board. 


“development of standards is crucial to moving 
forward.” 

Underlying such standards is the notion that 
UAS operations should not compromise the safety 
of people — whether on the ground, or in other 
aircraft. The degree to which existing standards 
will be appropriate to UASs depends, at least in 
part, on whether aviation hazards significantly 
change when the cockpit of the aircraft is separated 
from the vehicle itself. We assert that fundamental 
characteristics of UASs and the hazards they 
present may require a new regulatory framework, 
rather than adaptation of existing rules. 

The next section of this paper notes current 
trends in the aviation marketplace and advances in 
technology. These developments may make the 
“next great step” closer than many people realize, 
and hasten the need for regulations. In the 
subsequent sections, a historical perspective is 
given on hazards with respect to current regulations 
for manned aircraft. This is followed by a cursory 
examination of potential hazards that arise from the 
design and operation of UASs, and a discussion of 
pitfalls related to applying current regulations to 
unmanned systems. We conclude by proposing that 
the unique hazards posed by UAS design, 
operation, and flight crew invalidate assumptions 
underlying the current safety assessment process, 
and thus justify development of a new regulatory 
framework. 

Current Trends 

The number of unmanned aircraft in existence 
today is astonishing, as is the potential for flying 
these aircraft for public use and commercial 
ventures. The following subsections briefly 
highlight the current state of the UAS market and 
technologies that enable its rapid growth. 
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In the Marketplace 

Use of UASs in military operations is well- 
known. As of September 2004, some twenty types 
of unmanned aircraft, large and small, have flown 
over 100,000 total flight hours in support of 
military operations in the Middle East [2], 
Worldwide, at least forty-two nations are known to 
be developing or operating unmanned aircraft [3]. 
The vast majority are designed for military 
applications, and most of those are used for 
surveillance work [4], 

This category of aircraft is quite diverse. 
Vehicles in production range in size from those 
capable of being hand-launched to vehicles the size 
of transport aircraft, with weight ranging from a 
few ounces to over 26,000 pounds, with fixed and 
rotary wings, and with radically different altitude 
and endurance capabilities. Nanotechnology may 
expand this category to include extremely small 
vehicles, no larger than eight centimeters in length 
and weighing no more than ten grams [5]. 

Perhaps less well known is that unmanned 
aircraft are already in operation in civil or public 
use applications within the continental United 
States (US). In the past year, the FAA has granted 
at least fifty-five Certificates of Authorization 
(COAs) to government agencies, which permit an 
agency to operate a particular unmanned aircraft for 
a particular purpose in a particular area [1]. These 
authorizations typically include provisions to assure 
that the unmanned aircraft does not operate in a 
populated area and that the aircraft is observed, 
either by a chase aircraft or a trained observer. 

One example of operation under a COA comes 
from the US Customs and Border Protection (CBP) 
agency. Under its COA, CBP flew a Predator B for 
over 900 hours between September 2005 and April 
2006 to monitor illegal immigrant activities along 
the US-Mexico border. Temporary flight 
restrictions were imposed that allowed the Predator 
B to fly within a 1,500 square mile area along the 
border [6]. The surveillance activity has been 
viewed as a success, and credited with supporting 
the capture of approximately 1,800 illegal 
immigrants and the seizure of about 8,200 pounds 
of illegal drugs [7]. 

It may not be surprising that UASs are used for 
border patrol in remote or restricted areas; however, 


the potential use of UASs in urban areas might be. 
In June 2006, the Los Angeles County Sheriffs 
Department made newspaper headlines with their 
efforts to evaluate replacing manned helicopters 
with a portable unmanned drone for tasks such as 
searching for lost hikers or missing children, 
surveying fire zones, and chasing suspects fleeing 
on foot [8]. Current regulations require that 
operators of unmanned aircraft, for purposes other 
than recreation, must comply with FAA guidance 
and apply for a COA [9], While the FAA has not 
issued a COA in this particular case, the Los 
Angeles County Sheriffs Department exemplifies 
an eager civil market for unmanned aircraft. 

The commercial market is growing globally as 
well. Japan is often cited as having the most 
successful commercial operation of unmanned 
aircraft. In 1958, Japan began using manned 
helicopters to spray agrochemicals for insect and 
disease prevention in rice fields. Unmanned 
helicopters joined the effort in 1991. Today, more 
than 2,000 unmanned industrial helicopters are used 
in Japan, primarily in the agricultural sector [10, 

11]. Numerous other possibilities exist for 
commercial applications, including communi- 
cations, commercial security surveillance, aerial 
advertising, news and media support, and air 
freight, to name only a few. 

Current Trends in Technology 

Advances in automation technology have been 
at least one key to the rapid evolution of unmanned 
aircraft. Similarly, automated systems are the 
foundation of many visions to make air travel safer, 
more secure, more dependable, and available to 
more people than it is today [12], The airspace 
system already accommodates some degree of 
autonomous operation at the aircraft level, as 
described by Hadden [13]: 

Except during take-off and the final stages 
of landing, the modem commercial aircraft 
is routinely being flown by computers, 
monitored by human pilots. The systems in 
the latest generation of commercial aircraft 
commonly have fault monitoring and 
diagnostic functions which can cope with 
many failure conditions without pilot 
intervention. Automatic landing including 
flare and ground roll has been commonplace 
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for many years. When automation of the 
take-off segment of flight also becomes 
common it may be the norm for airliners to 
complete their missions without operation of 
the primary flying controls by a human pilot 
at any stage. 

The trend toward increased reliance on 
automation is evident in air traffic control as well. 
Plans for the Next Generation Air Transportation 
System envision using 4-dimensional trajectories 
(time-based paths from beginning to end) as the 
basis for planning and executing system operations. 
Automation will continuously analyze trajectories, 
taking into account weather information and 
forecast uncertainties, to support safe separation 
and efficient traffic flow [12]. 

To date, regulation has adjusted to 
accommodate increased automation. Some have 
suggested that modifications to existing rules can 
accommodate UASs [2, 13]. For example, the US 
military’s roadmap for unmanned aircraft calls for 
interpreting the existing Title 14 Code of Federal 
Regulations (CFR), known as Federal Aviation 
Regulations or FARs, “to also cover unmanned 
aviation and avoid the creation of dedicated UA 
regulations as much as possible” [2]. It is not clear, 
however, whether existing regulations that are 
based on a historical pairing of pilot and plane can 
be adapted to accommodate UASs, or whether 
UASs constitute a fundamentally different category 
of aircraft requiring their own set of regulations. 

To determine whether change to existing 
regulations is tractable, it is important to understand 
the underpinnings of those regulations. Those 
underpinnings include hazards and their role in the 
safety assessment process. 

Hazard Analysis Today 

In civil aviation, the pursuit of safety 
inevitably focuses attention on hazards. Aircraft 
designers, flight crews, mechanics, and regulators 
traditionally devote a great deal of effort, both 
explicitly and implicitly, to the identification and 
mitigation of aviation’s hazards. For the purpose of 
this discussion, we use the term “hazard” loosely to 
describe any situation or circumstance that may 
lead to danger or risk. Our concerns with hazards 
are those associated with UAS design, with UAS 


operation, and with the provision of air traffic 
services to UASs. 

In some cases, hazard analysis begins with 
reasoning about aircraft-level failure conditions or 
hazards — loss of pitch control, loss of all 
hydraulics, misleading attitude display — and works 
backward through the events, conditions, and 
circumstances that might create those hazards. In 
other cases, the reasoning begins with assumptions 
about undesirable events, such as engine-rotor burst 
or bird strikes, primarily in an attempt to identify 
and characterize potential threats to redundancy and 
independence of systems. Other analyses support 
and complete the safety-assessment picture. Taken 
together, these analyses provide a comprehensive 
understanding of operations and vulnerabilities at 
both a system level and an aircraft level. 

Where necessary or desirable to do so, hazards 
are mitigated through changes to aircraft design, 
operational procedures, training, inspection, or 
maintenance. The changes themselves must then be 
confirmed as acceptable. 

For manned aircraft, these processes are 
understood and practiced more or less universally. 
But there is a hidden assumption in this 
understanding, an assumption thought to be self- 
evident and rarely acknowledged. The assumption 
is worth stating here explicitly: aviation’s 
conventional hazards are hazards because they 
place human passengers and crew at risk. Implicit 
in most safety-related regulations is a desire to limit 
or eliminate harm to passengers and crew aboard 
aircraft, with a secondary consequence of limiting 
harm to people on the ground. Other consequences, 
notably economic consequences, are unrelated to 
the primary intent. 

In any proposed new rule or compliance 
method, regulators and designers are, in effect, 
treating all considerations as proxies for risk to the 
passengers aboard an aircraft. For instance, 
substantial engineering resources are spent 
evaluating the “crew workload” associated with 
new systems and procedures. Increased workload is 
bad, not because we are worried about crew 
exertion and toil per se, but because we know that 
an overtaxed, confused, and distracted pilot is more 
likely to be part of an accident that injures or kills 
people aboard the aircraft. 
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Many existing rules designed to protect 
passengers and crew may be irrelevant to UASs. 
Conversely, rules needed for the safe operation of 
UASs may sometimes be absent from the current 
regulations that govern manned flight. Regulation 
of unmanned systems must confront this mismatch 
directly. 

Hazard Analysis for UAS 

Understanding the hazards posed by an aircraft 
is an essential part of determining what regulations 
are needed to ensure safety. For unmanned aircraft, 
much of the hazard analysis to date [13-16] has 
focused on high-level concerns: ground impact with 
collateral damage to people and property, and 
midair collisions with other manned aircraft. The 
analysis often is predicated on the notion that the 
capability of an aircraft to cause harm to third 
parties is roughly proportional to its kinetic energy 
on impact. The analysis typically uses the kinetic 
energy and population densities to create a risk 
metric that is compared with historical accident data 
from manned aircraft. 

This top-down approach to hazard analysis 
provides a valuable frame of reference for 
establishing broad safety objectives. Flowever, this 
analysis implicitly assumes that hazards for 
unmanned aircraft are essentially the same as 
hazards for manned aircraft. To determine whether 
UASs introduce new hazards, we consider the 
question: do aviation hazards significantly change 
when the cockpit of the aircraft is separated from 
the vehicle itself? 

In the next section, we look at the recent crash 
of a Predator B to provide some insight, and then 
discuss some of the hazards that are highlighted by 
this accident. 

An Example UAS Accident 

In the early morning hours of April 25, 2006, a 
Predator B, providing surveillance of the US- 
Mexico border, went out of control and 
subsequently crashed on public property near 
Nogales, Arizona. According to the preliminary 
report from the National Transportation Safety 
Board (NTSB) [17], the ground control station for 
the flight included two control consoles, designated 
pilot payload operator (PPO)- 1 and PPO-2, with 


identical aircraft controls. For a typical flight, a 
certified pilot uses PPO- 1 for flight control, while a 
CPB agent controls the surveillance camera from 
PPO-2. The NTSB reported that the following 
events happened on April 25: 

The pilot reported that during the flight the 
console at PPO-1 "locked up", prompting him 
to switch control of the UAV [unmanned aerial 
vehicle] to PPO-2. Checklist procedures state 
that prior to switching operational control 
between the two consoles, the pilot must match 
the control positions on the new console to 
those on the console, which had been 
controlling the UAV. The pilot stated in an 
interview that he failed to do this. The result 
was that the stop/feather control in PPO-2 was 
in the fuel cutoff position when the switch over 
from PPO-1 to PPO-2 occurred. As a result, the 
fuel was cut off to the UAV when control was 
transferred to PPO-2. 

The pilot stated that after the switch to the other 
console, he noticed the UAV was not 
maintaining altitude but did not know why. As 
a result he decided to shut down the [ground 
control station] so that the UAV would enter its 
lost link procedure, which called for the UAV 
to climb to 15,000 feet above mean sea level 
and to fly a predetermined course until contact 
could be established. With no engine power, the 
UAV continued to descend below line-of-site 
communications and further attempts to re- 
establish contact with the UAV were not 
successful. 

This example raises several issues relevant to 
UAS hazard analysis, especially with respect to 
flight control. The first and perhaps most obvious 
issue is that many flight-critical control functions 
for a UAS will be located within the ground control 
station, not on the aircraft. So, proper design and 
use of flight controls is essential, regardless of 
where those controls reside. In this example, the 
secondary control console was able to command an 
unsafe fuel state to the shutoff valve. While 
procedures were in place to avoid this, there was no 
automation or other means similar to back-driven 
controls in manned aircraft which would ensure 
synchronization between control consoles. 

Another issue concerns the coupling of flight 
control and payload control. The hazards 
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associated with the payload and the mission are not 
necessarily at the same level of criticality as the 
control of the aircraft. Wherever there are shared 
resources or interactions between the payload and 
the air vehicle, there is a need to analyze and 
manage this sharing of resources to ensure that all 
hazards have been mitigated. 

A third issue worth noting involves the trade- 
off between manual control and autonomous 
operation. In manned aircraft, the pilot is always 
responsible for monitoring the autonomous 
operation of the aircraft and can intervene to 
mitigate most operational hazards. The loss of a 
command and control link in a UAS, however, 
removes the possibility of human intervention. In 
the Predator accident, the amount and type of 
control authority available to the aircraft after loss 
of link was dependent on inadequate assumptions 
about the state of the aircraft (for example, the 
ability to control thrust). 

Discussion of UAS Hazards 

In this section, we broaden the discussion of 
hazards to three domains: 

UAS Design Domain: includes all components, 
parts, and elements of an unmanned system. 
This includes the air vehicle, control stations, 
communication links, and any specialized 
launch and recovery equipment, and payload. 

UAS Flight Crew Domain: includes the 

capabilities, human factors, and workload of the 
human pilot of the vehicle and operator of the 
payload. 

UAS Operational Domain: includes the vehicle’s 
operations within both controlled and 
uncontrolled airspace, above both populated 
and unpopulated areas, over either land or 
water. This includes take off, landing, and any 
airport operations. 

While the domains are unique, decisions 
within one domain have a profound effect on the 
design and hazards in other domains. The 
discussion includes some of these interactions as 
examples; however, the examples are not intended 
to be a comprehensive study of all UAS hazards. 

For each domain, important differences 
between manned and unmanned systems are 


identified first. Then examples are given that 
describe unique hazards introduced by UASs or 
known hazards that take on a new spin. It should be 
noted that not all of these hazards apply to all 
UASs; they are included because the UAS design or 
operation space might be unduly restricted if the 
regulations do not account for them. 

Design Domain 

The design domain for manned aircraft 
systems comprises all of the elements that are part 
of the air vehicle itself. For a UAS, this domain 
extends beyond the vehicle to include any external 
systems that participate in control of the aircraft. 

The vehicle, the control station with pilot displays 
and flight controls, the communication links for 
command and control, any special launch and 
recovery systems, and even the payload are all part 
of the UAS design domain. 

Communication links are critical to UAS 
operations. This includes links between the vehicle 
and the control station and also between the pilot 
and ATC. There are typically three types of radio 
communications links between the vehicle and the 
control station: a flight control link; a telemetry link 
for transmitting vehicle health, status, and situation 
awareness data; and, a link used to control, manage, 
or monitor payload sensors or equipment [4]. 

UAS pilots may communicate with ATC in the 
same way that conventional pilots do, using voice 
radio frequencies. But, UAS pilots also have 
additional options, such as telephone connections, 
between the ground station and ATC. Other 
possibilities include using the unmanned aircraft as 
a relay between the UAS pilot and ATC, or 
(perhaps in the future) for the air vehicle to 
automatically respond to ATC commands. 

While the cockpit of a manned aircraft 
provides all of the equipment necessary for flight 
control, the UAS control station provides the 
facilities necessary for remote control of the air 
vehicle and payload. The control station may 
include an operator console, with command-input 
device (joysticks and switches), video monitors, 
control station data encoder and transmitter, data 
and video receivers and antennas. Size and 
equipage of the control station varies. Location 
varies, too. A control station may be in one fixed 
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location, or may be mobile. Many military ground 
control stations look like specially outfitted trailers, 
but a control station might also look like a 
conventional computer placed in an office — 
perhaps far away from an airport. In addition, the 
control station may not necessarily be located on 
the ground. For example, the control station could 
be in an aircraft or on a ship. 

A final difference worth noting involves the 
payload. Instead of transporting people, each UAS 
typically carries payload related to an operational 
mission. Design of commercial manned aircraft 
separates the effects of payload from vehicle 
control. For unmanned vehicles, size and weight 
constraints may motivate system designs that 
integrate payload and flight control. This is 
especially true for small UASs. In other cases, the 
nature of the mission may dictate integration, such 
as surveillance systems that automatically track 
their targets without pilot input. 

The communication links, control station, and 
payload have the potential to introduce new 
hazards. From a system design perspective, loss of 
vehicle control is a primary concern. Below are 
brief descriptions of potential problems that may 
lead to loss of vehicle control. 

Loss of the command and control link 

In manned aircraft — absent failures — pilots 
always have command of their aircraft. However, 
in a UAS, the command and control link may be 
lost, leaving the UAS pilot without command of his 
aircraft. Radio links are known to be vulnerable to 
interruptions, latency, and data degradation. So, 
intermittent loss of a flight control link is an 
expected event, not a failure. As such, UAS 
designs provide means to deal with these 
interruptions. Those means, however, can provide 
only temporary safety measures, at best. Persistent 
loss of link can lead to complete loss of vehicle 
control. 

Because the command and control link is part 
of a flight critical function, much greater attention 
must be paid to its integrity. Having a secure civil 
frequency for command and control, within the 
FAA’s protected spectrum, is a major challenge for 
UAS [4]. The pilot must be confident that the 
information presented on the displays is from the 
vehicle under control (that is, that the information is 


not for some other vehicle, nor is it from a 
malicious source) and the communication uplink to 
the vehicle must be protected from interference 
(both spurious and malicious) 2 . 

Reliance on third-party communication 

Manned aircraft typically rely on communi- 
cation and navigation systems provided and 
evaluated by the regulatory authorities rather than 
relying on third-party communication systems. For 
UAS, where the control station and the aircraft may 
be separated by hundreds or thousands of miles, 
there may be a greater dependence on third-party 
communication systems for flight critical functions. 
Issues related to the reliability and availability of 
third party communication systems may need to be 
addressed. 

Ground station environment 

Some hazards associated with traditional 
cockpit environments, such as smoke, fire, and 
toxic fumes and flammability of materials, will 
have to be considered for ground stations, too. 

Other hazards that directly impact a control station 
and UAS pilot, may not directly impact the vehicle. 
For example, events such as earthquakes or 
tornados may impact the control station, but not 
impact the aircraft in flight. Although hazards in 
the ground station environment differ from the 
traditional cockpit, they may be comparable to 
some hazards in the physical environment of ATC 
and may be dealt with accordingly. 

Security of the control station is another 
matter. Because the control station may be located 
outside the relatively secure confines of a military 
base or an airport, additional security measures may 
be required. An aircraft that is controlled by a 
malicious person is even more dangerous than an 
uncontrolled aircraft. Analysis of the control 
station hazards should take into account impact on 
the ability to maintain control of the vehicle. 

Shared resources 

The UAS must be evaluated with respect to 
potential interactions between the vehicle and its 


2 It is important to recognize that solutions to this problem 
developed for military systems may or may not be adequate for 
private use. For example, military systems may have 
bandwidth that is unavailable to commercial UAS operators. 


6 



payload. When resources are shared between flight 
functions and payload functions, proper manage- 
ment of these shared resources is essential. For 
example, the payload and the flight critical systems 
may share power and cooling systems; therefore, it 
must be assured that the payload’s power and 
cooling needs do not interfere with flight critical 
functions. 

Payload induced loss of vehicle control 

While commercial manned aircraft separate the 
effects of payload from vehicle control, some UAS 
designs may require their integration. For example, 
the ability for payloads to track a target, such as a 
thermal signature, may require direct control inputs 
to the aircraft’s avionics. 

In contrast to these new hazards, there may 
also be areas in which UAS design may reduce 
certain hazards. Two of these are discussed below. 

Payload mitigation of certain failures 

A sophisticated payload may provide a means 
to mitigate certain failures. For instance, a 
surveillance instrument (for example, radar, 
forward-looking infrared, or camera) may be used 
to provide sensor data, in essence providing a 
backup for primary sensors. A payload that consists 
of communication equipment may provide a backup 
for loss of the command and control li nk . 

Significant questions must be addressed, however, 
about whether payload generated information 
should be used in support of flight- critical 
functions. 

Alternate communications with air traffic control 

Loss of communication for manned aircraft 
during a flight under Instrument Flight Rules 
requires strict lost communication procedures to be 
followed by both the on-board pilot and the air 
traffic controllers (Federal Regulations 14 CFR, 

Part 91.185). This problem may be mitigated for 
unmanned aircraft because there are alternate 
communication means available (for example, 
telephone lines). This presumes that regulations 
would be in place to require this type of back up 
communication both at the UAS crew stations and 
at ATC centers. The UAS flight crews would have 
to be trained and certified to properly use this 
facility, but it should result in considerably less 


disruption than loss of communication in manned 
aircraft. 

Flight Crew Domain 

Most UASs provide some method of 
displaying the state of the air vehicle to the pilot 
and a means for the pilot to change this state. In 
this section, the term pilot is used for the person in 
direct control of the UAS. UAS crew includes the 
pilot and any operators of mission related 
equipment aboard the aircraft. 

The separation of the crew environment from 
the aircraft introduces a number of new hazards and 
training requirements that are not covered by the 
current training and certification requirements for 
manned vehicles. One such difference in training 
relates to physical cues. Pilots of manned aircraft 
require training to properly interpret the physical 
sensations induced by the movement of the aircraft. 
For example, training in recognition and recovery 
from vertigo is required for all pilots during 
instrument training, which presumably will be 
unnecessary for a UAS crew. 

Also, the UAS crew members may be expected 
to control more than one air vehicle at a time. If 
there are multiple UAS crew members for a given 
air vehicle, the specific cockpit resource manage- 
ment (CRM) procedures in manned aircraft would 
not necessarily be correct for UAS crews. For 
example, some current CRM techniques require one 
pilot to be assigned visual acquisition duties while 
the other pilot is responsible for monitoring the 
flight displays. The exact type of training and 
controls will depend heavily on the type of 
certification requirements and categories of UASs. 
However there are some hazards unique to all UASs 
that will have to be addressed. 

Many of the hazard definitions in the advisory 
material for safety (such as FAA Advisory Circular 
23.1309-1C [18]), take into account increases in 
pilot and flight crew workload. In those definitions, 
workload is defined based on a traditional cockpit 
environment where crew replacements and rotations 
are not possible. Such definitions will be 
inadequate for UAS crew workload where the 
degree of automation on board the air vehicle will 
be a significant factor. 
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Reduced pilot situational awareness 

A pilot aboard an aircraft can use physical 
senses such as sight, smell, and touch to detect 
certain hazardous situations. Removing these 
“sensors” from the aircraft will have an u nk nown 
effect on the ability to detect some hazardous 
situations such as equipment failures and bad 
weather. The issues associated with developing 
sensors to replace this functionality and determining 
the most effective way to present this information to 
the UAS pilot are largely unknown. At best the 
introduction of a communication link will add 
delay. The degree to which this additional delay 
affects the pilot’s performance is u nk nown. 

Situational awareness is key to the ability to 
mitigate problems. In traditional manned designs, 
the on-board pilot plays an important role in 
systems monitoring and risk mitigation. The 
situational awareness of a UAS pilot is at least 
different, if not reduced, compared with an on- 
board pilot. As such, effectiveness of a UAS pilot 
to monitor systems and mitigate risk is u nk nown. 
The potential exists to have on-board automation 
perform some of these functions; however, this is 
placing automation in a new role. If this role is 
shared between pilot and automation, then the 
blending of automation and UAS crew inputs will 
have to be considered. This is complicated further 
because the on-board automation may have a more 
accurate view of the state of the vehicle. 

Multiple vehicle control 

One possibility for ground control stations is 
the ability for a single pilot to control multiple 
vehicles. This feature is being actively pursued by 
the developers of military UASs. In this situation, 
new hazards arise from both an increased pilot 
workload and ensuring that the information 
presentation does not confuse the pilot about which 
aircraft is being controlled. Training specific to 
controlling multiple aircraft may be required. 

Equipment failure training 

In any aircraft system, there are hazards 
introduced by equipment failures. An on-board 
flight crew may be able to physically or visually 
establish the extent and type of some failures such 
as fire, smoke, and vibration, and they may have 
direct means to mitigate some of those failures. For 
example, a crew member may be able to set a fuel 


cutoff valve in a Part 23 aircraft. Equipment 
failures on the vehicle may be dealt with through 
design mitigations, but also through UAS flight 
crew training and procedures specific to remote 
operation. 

Training for environmental hazards on the ground 

As mentioned above, ground control stations 
are subject to physical environmental hazards such 
as a fire, and to other disturbances such as an 
earthquakes or tornados. A UAS flight crew may 
require training relative to establishing a safe 
control state of the air vehicle in the event of such 
hazards. While such hazards will have to be dealt 
with by design mitigations, procedural mitigations 
also may be necessary. 

Operational Domain 

Civil airspace contains numerous aircraft 
which have been allocated both static (Restricted) 
airspace and dynamic airspace (protective 
separation boundaries between aircraft assigned by 
ATC). Some of the characteristics of unmanned 
aircraft may present challenges to the rules for 
airspace use and provision of air traffic services. 
Chief among these challenges is the capability to 
“see and avoid” 3 that would enable a UAS to detect 
air traffic, hazardous weather, terrain, and other 
obstructions and safely maneuver around them as 
per FAR Part 91.113 [4], 

Other challenges relate to operational 
flexibilities inherent in unmanned aircraft. The 
scope of UAS missions varies widely. Some 
missions may require transit from one location to 
another, while other missions may require loitering 
over a particular location for an extended time. 

Some UASs may operate for substantially longer 
periods of time or at higher altitudes than their 
manned counterparts. 

UASs have significantly more options for 
surface operations, including pre-flight preparation, 
take-off or launch, and landing than manned aircraft 
that are typically dependent on services provided by 
conventional airports. Launch and recovery systems 
common in military aircraft, but deemed too risky 
for civil operation, may be used for UASs. For 


3 Also referred to as “sense and avoid” or “detect and avoid”. 



instance, launch systems may include catapult or 
rocket assisted takeoffs. These systems may be 
fixed at an airport or part of a mobile launch 
system. Recovery systems may include arresting 
wires, net capture systems, and recovery 
parachutes. These, too, may be located at an airport 
or as part of a mobile recovery system. 

In emergency situations, UASs may have 
options that are unavailable to manned aircraft 
including pyrotechnic destruction systems and a 
dedicated structure at an airport to contain the crash 
(a “crashport”). These systems can be used to 
maintain safety of people and property but result in 
a vehicle hull loss. 

Many of the operational hazards for UAS are 
associated with the loss of the command capability 
and subsequent loss of control of the aircraft as 
described in the design domain. The following 
discussion focuses on additional hazards relevant to 
UAS operations. 

Situational awareness for ground operations 

Ground operations for UASs vary extensively. 
In some cases, the UAS pilot may be responsible 
for pre-flight procedures, start, and take-off or 
launch. In other cases, the UAS pilot may be far 
away from the vehicle and rely on ground support 
crew for some or all of those functions. In the latter 
case, the UAS pilot may be unaware of ground 
personnel or obstacles around the vehicle. The pilot 
may start the engine or cause the vehicle to make a 
sudden move that ground personnel were not 
expecting. 

Safety margins for ground operations 

In general, safety margins with respect to 
separation standards are much smaller on the 
ground than in the air. For example, most aircraft 
controlled by ATC are separated by several miles in 
flight. In a conventional aiiport setting, however, 
aircraft are separated by only a few tens of feet on a 
taxiway. If unmanned aircraft are operated in 
conventional aiiport settings, existing standards for 
safety margins between aircraft on the ground may 
be insufficient given the delay inherent between a 
UAS pilot’s command and subsequent vehicle 
movement. 


Entrance to controlled airspace 

In most cases, manned aircraft enter controlled 
airspace through relatively few areas such as 
airports and helipads. UAS could enter controlled 
airspace through these means or, may also enter 
through uncontrolled airspace. UAS have a much 
larger range of options for launch and recovery 
(catapults, hand launch, bungee cords), so they 
could enter uncontrolled airspace from almost 
anywhere (field, rooftop, moving truck, ship, etc.) 
[2, 20], then transition to controlled airspace. 

Although some manned aircraft enter 
controlled airspace through uncontrolled airspace, 
for certain UAS applications, this may be their 
normal mode of operation. Where and how UAS 
enter controlled airspace may impact air traffic 
management. As such, this may change operational, 
training, or equipage requirements. 

Flight termination 

One of the unique capabilities of a UAS from a 
safety standpoint is the ability to terminate flight 
prematurely without concern for passengers. 
However, such termination may injure people on 
the ground. Simply terminating the flight when 
something goes wrong is unacceptable. To ensure 
that people on the ground are not affected, 
termination of flight should place the vehicle in an 
unpopulated area. 

This may not be enough, however, to ensure 
the safety of people on the ground. If the vehicle is 
carrying dangerous materials, then terminating the 
flight may endanger people on the ground — even if 
they are not directly affected by the impact. For 
example, an aircraft with a large quantity of fuel 
could start a forest fire. 

Additional air traffic control workload 

If the communication link between the aircraft 
and UAS pilot is lost or corrupted, ATC may have a 
better view of the vehicle than the UAS pilot. 
Consequently, ATC may have a new role in 
reporting the state of the vehicle to the UAS pilot in 
certain types of failure situations. Such a role 
would impose additional workload on ATC. 
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Implications for Regulation 

The ultimate acceptance of unmanned aircraft 
in civil airspace critically depends on maintaining 
the perceived level of safety of the current airspace 
environment [2, 16, 19]. The proposed baseline is 
that UASs establish an equivalent level of safety 
(ELOS) to that of corresponding manned aircraft 
operations. Any regulatory framework that 
attempts to establish an ELOS must recognize the 
different types of operations and architectures to be 
used for UASs and the unique hazards they present. 

Regulation of UAS design, operation, and 
flight crew 

Current regulations for certifying and 
operating air vehicles can be categorized as follows: 
vehicle design requirements, operational require- 
ments, continued airworthiness requirements, and 
flight crew certification requirements. The regula- 
tory requirements that govern the acceptability of 
aircraft design, operations, and pilot requirements 
can be found in 14 CFR, Chapter I. The design of 
aircraft (14 CFR Parts 23, 25, 27, 29, 31, and 33) 
relate to requirements for specific aircraft types and 
propulsion mechanisms with certain characteristics. 
Those regulations impose various requirements on 
the design and operation of the aircraft and on 
flight-crew acceptance that would not necessarily 
be required for a given UAS. 

For example, hazards resulting in airframe 
destruction are, by definition, considered cata- 
strophic for manned aircraft, due to the direct 
effects on passengers and crew. From a public- 
safety standpoint, the destructive sacrifice of a 
vehicle may be perfectly acceptable if that sacrifice 
avoids an undesirable collision with a manned 
aircraft or people or property on the ground. In 
short, new regulations are needed to deal with the 
unique hazards, such as loss of the command and 
control link and loss of situational awareness, 
associated with UASs. 

It also may be necessary to identify new types 
of operations for UASs. Traditional distinctions 
among commercial, private, and recreational 
operations will not have the same meaning for 
UASs. In general, loss of control of a unmanned 
aircraft has no analog to manned aircraft, so new 
operational rules will have to address loss of control 


differently. This may involve airspace restrictions, 
operational mitigations for certain failure conditions 
such as loss of the communication link, and so on. 
In many cases, such as the loss of communication 
link, new operational requirements may have to be 
implemented as part of aircraft design. 

Substantially different regulations for UAS 
flight crew may be needed, too. All of the current 
regulations governing pilot qualifications (14 CFR 
Chapter I, Subchapter D), certification, and training 
are based on the implicit assumption that the pilot is 
collocated with the vehicle being controlled. The 
current regulations that deal with certification of 
pilots provide for different types of certificates 
(such as private, commercial, and instructor), 
category ratings (such as single engine land and 
multiengine sea), operational ratings (such as 
Instrument Flight Rules and Visual Flight Rules), 
and type ratings for specific aircraft (such as a 
Boeing 737 or Airbus A320). In all of the cases, 
when the operating characteristics of the aircraft are 
significantly different from existing aircraft, 
additional regulations are created to ensure the 
qualification of the flight crew. 

The inherent separation of the control station 
from the air vehicle provides a much greater 
disparity than current aircraft, that may require 
different rules for category, operational, and type 
ratings. Under the current policy [9], UAS crew 
members need only meet minimum medical 
requirements, have passed the private pilot 
knowledge test, and, if flying on an instrument 
flight plan, be a certified pilot with an instrument 
rating. None of these regulations deal with 
establishing qualifications for handling the hazards 
identified in the previous sections. The large 
variety of UASs in terms of size, autonomy level, 
and operational use, makes developing certification 
criteria for human factors extremely difficult [4], 
Decisions affecting the architecture of the different 
domains as well as the interaction among these 
domains will need to influence the regulations 
relating to operator training, certificate types, and 
operator privileges. 

Regulatory Challenges 

The hazards in this paper have been grouped 
according to specified domains that map to the 
basic structure of the regulations. The UAS design 
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domain would be addressed in 14 CFR Subchapter 
C, the flight crew domain in Subchapter D, and the 
operational domain in Subchapters E, F and G. The 
challenge is to establish regulations unique to UAS 
hazards that permit addressing hazards at the 
service level and permit optimization of design 
parameters to take advantage of the unique 
characteristics of UASs. For example, redundancy 
and autonomy (such as preprogrammed flight plans) 
could be traded against the integrity of ground 
monitoring (electronic or visual) and safety- 
mitigation systems aboard the aircraft (detonators, 
parachutes). 

The causes of the Predator accident discussed 
earlier in the paper are clearly identifiable and 
preventable. Prevention of such accidents requires 
that current regulations be augmented with rules for 
UAS operation, design of UAS control consoles, 
UAS communication links, acceptable levels of 
UAS autonomy, training of UAS crews, and so on. 
Existing regulations fail to address these and many 
related areas. 

Summary 

The use of unmanned aircraft in national 
airspace has been characterized as the next great 
step forward in the evolution of civil aviation. 
Unique characteristics of unmanned aircraft allow a 
wide range of applications ill-suited for manned 
systems. The tremendous economic potential is 
obvious, providing substantial motivation for taking 
that step. Regulation is crucial to moving forward. 

The unique characteristics of UASs that 
provide such promise, also create regulatory 
challenges. Even in the most conventional UAS 
designs, significant new hazards arise from ground 
control stations, communication links, and 
specialized avionics. The effect of failures in these 
elements brings a new twist to long-established 
hazards such as loss of aircraft control and loss of 
situational awareness. In this paper, we have 
provided a cursory look at some of those twists and 
related deficiencies in existing regulation for UAS 
design, operation, and flight crew. 

Allowing routine and safe access of UASs to 
civil airspace is clearly a complex problem that 
involves numerous issues including regulation. 
Adaptation of existing rules, however, may be 


inadequate to handle the new hazards posed by 
UASs. This leads us to the proposition that UASs 
are a fundamentally new type of aircraft that will 
require a new regulatory framework to both 
maintain the safety of the national airspace system 
and to enable the full benefit of unmanned aviation. 
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